b597f3518d
uv lock --upgrade under a new supply-chain cooldown (exclude-newer = "7 days"): releases younger than a week never enter the lock, so a hijacked or yanked-within-days upload can't land on day one. 158 packages move; the advisory set clears entirely (trivy 0.76.0 on uv.lock + pyproject.toml: 32 findings -> 0): aiohttp 3.14.3 -> 3.14.5 pyjwt 2.13.0 -> 2.15.1 urllib3 2.7.0 -> 2.8.0 oauthlib 3.3.1 -> 4.0.0 certifi 2026.1.4 -> 2026.10.19 fsspec 2026.2.0 -> 2026.9.0 multidict 6.7.1 -> 6.9.1 opentelemetry-* 1.40.0 -> 1.45.1 pillow 12.1.1 -> 13.0.0 pyproject floors raised for the direct deps that carried advisories (pyjwt, fsspec, opentelemetry-api/-sdk). The cooldown lives in [tool.uv], and uv.toml is folded into it: uv ignores [tool.uv] whenever a uv.toml exists, and the images copy only pyproject.toml + uv.lock — the lock records the span, so `uv sync --locked` fails anywhere the setting isn't visible. Held deliberately: - pymupdf <2: 2.x folds the former pymupdf_layout code (Polyform Noncommercial / Artifex commercial) into the core wheel and pulls onnxruntime into every image — a licence call, not a routine bump. 1.28.2 is the current 1.x. - duckdb stays on 1.5.6: 2.0.0 is six days old, so the cooldown keeps it out; it arrives as a reviewable Renovate major. polars 1.38 -> 2.0 removed String -> Date casts; the one src caller (aco.express.pharmacy) now parses explicitly when the column arrives as a string, and keeps working for date-typed and duckdb inputs. Full suite: 15591 passed. pkg-manifest regenerated (it was already stale on main). Refs #1365
675 lines
14 KiB
JSON
675 lines
14 KiB
JSON
{
|
|
"apt": {
|
|
"infra/images/selkies/Dockerfile.upstream": [
|
|
"\"./virtualgl32_${VIRTUALGL_VERSION}_amd64.deb\"",
|
|
"\"./virtualgl_${VIRTUALGL_VERSION}_amd64.deb\"",
|
|
"./google-chrome-stable.deb",
|
|
"./heroic_launcher.deb",
|
|
"./kasmvncserver.deb",
|
|
"./lutris.deb",
|
|
"./rustdesk.deb",
|
|
"./selkies-js-interposer.deb",
|
|
"./virtualgl_${VIRTUALGL_VERSION}_arm64.deb",
|
|
"GStreamer",
|
|
"Operating",
|
|
"adwaita-icon-theme-full",
|
|
"aom-tools",
|
|
"appmenu-gtk3-module",
|
|
"apt-utils",
|
|
"ark",
|
|
"aspell",
|
|
"aspell-en",
|
|
"breeze",
|
|
"breeze-cursor-theme",
|
|
"breeze-gtk-theme",
|
|
"breeze-icon-theme",
|
|
"dbus-user-session",
|
|
"dbus-x11",
|
|
"debconf-kde-helper",
|
|
"dependencies",
|
|
"desktop-file-utils",
|
|
"dolphin",
|
|
"dolphin-plugins",
|
|
"enchant-2",
|
|
"fakeroot",
|
|
"fcitx",
|
|
"fcitx-frontend-gtk2",
|
|
"fcitx-frontend-gtk3",
|
|
"fcitx-frontend-qt5",
|
|
"fcitx-hangul",
|
|
"fcitx-libpinyin",
|
|
"fcitx-m17n",
|
|
"fcitx-module-dbus",
|
|
"fcitx-module-kimpanel",
|
|
"fcitx-module-lua",
|
|
"fcitx-module-x11",
|
|
"fcitx-mozc",
|
|
"fcitx-sayura",
|
|
"fcitx-tools",
|
|
"fcitx-unikey",
|
|
"filelight",
|
|
"firefox",
|
|
"frameworkintegration",
|
|
"fuse",
|
|
"gir1.2-wp-0.5",
|
|
"gstreamer1.0-libcamera",
|
|
"gstreamer1.0-pipewire",
|
|
"gstreamer1.0-plugins-bad",
|
|
"gwenview",
|
|
"haveged",
|
|
"hunspell",
|
|
"i965-va-driver-shaders",
|
|
"i965-va-driver-shaders:i386",
|
|
"im-config",
|
|
"intel-gpu-tools",
|
|
"intel-media-va-driver-non-free",
|
|
"intel-media-va-driver-non-free:i386",
|
|
"kcalc",
|
|
"kcharselect",
|
|
"kde-baseapps",
|
|
"kde-config-fcitx",
|
|
"kde-config-gtk-style",
|
|
"kde-config-gtk-style-preview",
|
|
"kde-spectacle",
|
|
"kdeadmin",
|
|
"kdeconnect",
|
|
"kdegraphics-thumbnailers",
|
|
"kdf",
|
|
"kdialog",
|
|
"kfind",
|
|
"kget",
|
|
"khotkeys",
|
|
"kimageformat-plugins",
|
|
"kinfocenter",
|
|
"kio",
|
|
"kio-extras",
|
|
"kmag",
|
|
"kmenuedit",
|
|
"kmix",
|
|
"kmod",
|
|
"kmousetool",
|
|
"kmouth",
|
|
"ksshaskpass",
|
|
"ktimer",
|
|
"kwin-addons",
|
|
"kwin-x11",
|
|
"kwrite",
|
|
"libc6:i386",
|
|
"libdatetime-perl",
|
|
"libdbusmenu-glib4",
|
|
"libdbusmenu-gtk3-4",
|
|
"libdrm2:i386",
|
|
"libegl-dev",
|
|
"libegl1:i386",
|
|
"libffmpeg-nvenc-dev",
|
|
"libgail-common",
|
|
"libgdk-pixbuf2.0-bin",
|
|
"libgl1:i386",
|
|
"libgles1:i386",
|
|
"libgles2:i386",
|
|
"libglu1:i386",
|
|
"libglvnd0:i386",
|
|
"libglx0:i386",
|
|
"libgstreamer-plugins-bad1.0-dev",
|
|
"libgtk-3-bin",
|
|
"libgtk2.0-bin",
|
|
"libkf5baloowidgets-bin",
|
|
"libkf5dbusaddons-bin",
|
|
"libkf5iconthemes-bin",
|
|
"libkf5kdelibs4support5-bin",
|
|
"libkf5khtml-bin",
|
|
"libkf5parts-plugins",
|
|
"libopengl0:i386",
|
|
"libopenh264-dev",
|
|
"libpipewire-0.3-modules",
|
|
"libpipewire-module-x11-bell",
|
|
"libqt5multimedia5-plugins",
|
|
"libreoffice",
|
|
"libreoffice-kf5",
|
|
"libreoffice-plasma",
|
|
"libreoffice-style-breeze",
|
|
"librsvg2-common",
|
|
"libsm6:i386",
|
|
"libspa-0.2-bluetooth",
|
|
"libspa-0.2-jack",
|
|
"libspa-0.2-modules",
|
|
"libva-dev",
|
|
"libva2:i386",
|
|
"libvulkan-dev:i386",
|
|
"libx11-6:i386",
|
|
"libxau6:i386",
|
|
"libxcb1:i386",
|
|
"libxdmcp6:i386",
|
|
"libxext6:i386",
|
|
"libxtst6:i386",
|
|
"libxv1:i386",
|
|
"locales",
|
|
"media-player-info",
|
|
"mesa-utils-extra",
|
|
"mesa-vulkan-drivers:i386",
|
|
"meson",
|
|
"nvtop",
|
|
"okular",
|
|
"okular-extra-backends",
|
|
"packages",
|
|
"pipewire",
|
|
"pipewire-alsa",
|
|
"pipewire-audio-client-libraries",
|
|
"pipewire-jack",
|
|
"pipewire-libcamera",
|
|
"pipewire-locales",
|
|
"pipewire-v4l2",
|
|
"pipewire-vulkan",
|
|
"plasma-browser-integration",
|
|
"plasma-calendar-addons",
|
|
"plasma-dataengines-addons",
|
|
"plasma-desktop",
|
|
"plasma-discover",
|
|
"plasma-integration",
|
|
"plasma-runners-addons",
|
|
"plasma-widgets-addons",
|
|
"plasma-workspace",
|
|
"playonlinux",
|
|
"print-manager",
|
|
"q4wine",
|
|
"qapt-deb-installer",
|
|
"qml-module-org-kde-qqc2desktopstyle",
|
|
"qml-module-org-kde-runnermodel",
|
|
"qml-module-qt-labs-platform",
|
|
"qml-module-qtgraphicaleffects",
|
|
"qml-module-qtquick-xmllistmodel",
|
|
"qt5-gtk-platformtheme",
|
|
"qt5-image-formats-plugins",
|
|
"qt5-style-plugins",
|
|
"qtspeech5-flite-plugin",
|
|
"qtvirtualkeyboard-plugin",
|
|
"software-properties-qt",
|
|
"sonnet-plugins",
|
|
"ssl-cert",
|
|
"sudo",
|
|
"svt-av1",
|
|
"sweeper",
|
|
"system",
|
|
"systemsettings",
|
|
"transmission-qt",
|
|
"tzdata",
|
|
"ubuntu-drivers-common",
|
|
"udev",
|
|
"va-driver-all",
|
|
"va-driver-all:i386",
|
|
"vdpau-driver-all:i386",
|
|
"vlc",
|
|
"vlc-plugin-access-extra",
|
|
"vlc-plugin-notify",
|
|
"vlc-plugin-samba",
|
|
"vlc-plugin-skins2",
|
|
"vlc-plugin-video-splitter",
|
|
"vlc-plugin-visualization",
|
|
"winehq-${WINE_BRANCH}",
|
|
"wireplumber",
|
|
"wireplumber-locales",
|
|
"xcvt",
|
|
"xdg-user-dirs",
|
|
"xdg-utils",
|
|
"xvfb"
|
|
]
|
|
},
|
|
"apk": {
|
|
"infra/gitea/Dockerfile": [
|
|
"bash",
|
|
"build-base",
|
|
"ca-certificates",
|
|
"curl",
|
|
"dumb-init",
|
|
"gettext",
|
|
"git",
|
|
"gnupg",
|
|
"nodejs",
|
|
"npm",
|
|
"openssh-keygen"
|
|
]
|
|
},
|
|
"pypi": {
|
|
"project_prod": [
|
|
{
|
|
"name": "pydantic",
|
|
"version": ">=2.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pymupdf",
|
|
"version": ">=1.27.2,<2",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "python-docx",
|
|
"version": ">=1.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "xlrd",
|
|
"version": ">=2.0.2",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pydantic",
|
|
"version": ">=2.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "httpx",
|
|
"version": ">=0.28.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "duckdb",
|
|
"version": ">=1.5.4",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "narwhals",
|
|
"version": ">=2.17.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "sqlglot",
|
|
"version": ">=26.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pyarrow",
|
|
"version": ">=23.0.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "duckdb",
|
|
"version": ">=1.5.4",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "fastapi",
|
|
"version": ">=0.139.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "uvicorn",
|
|
"version": ">=0.41.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "httpx",
|
|
"version": ">=0.28.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pyjwt",
|
|
"version": ">=2.15.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "cryptography",
|
|
"version": ">=50.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "httpx",
|
|
"version": ">=0.28.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "fsspec",
|
|
"version": ">=2026.6.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "narwhals",
|
|
"version": ">=2.17.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pyarrow",
|
|
"version": ">=23.0.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pydantic",
|
|
"version": ">=2.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "markdown-it-py",
|
|
"version": ">=4.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "mdit-py-plugins",
|
|
"version": ">=0.4",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "httpx",
|
|
"version": ">=0.28.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "fastapi",
|
|
"version": ">=0.139.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "uvicorn",
|
|
"version": ">=0.41.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "langchain-core",
|
|
"version": ">=0.3.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "langchain-ollama",
|
|
"version": ">=0.2.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "langchain-postgres",
|
|
"version": ">=0.0.12",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "psycopg",
|
|
"version": ">=3.2.0",
|
|
"extras": "binary"
|
|
},
|
|
{
|
|
"name": "sqlalchemy",
|
|
"version": ">=2.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pyyaml",
|
|
"version": ">=6.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pydantic",
|
|
"version": ">=2.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "typer",
|
|
"version": ">=0.24.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "uvicorn",
|
|
"version": ">=0.41.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "httpx",
|
|
"version": ">=0.28.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pydo",
|
|
"version": ">=0.29.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "resend",
|
|
"version": ">=2.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "narwhals",
|
|
"version": ">=2.17.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pydantic",
|
|
"version": ">=2.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "duckdb",
|
|
"version": ">=1.5.4",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "narwhals",
|
|
"version": ">=2.17.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "duckdb",
|
|
"version": ">=1.5.4",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "narwhals",
|
|
"version": ">=2.17.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pydantic",
|
|
"version": ">=2.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "duckdb",
|
|
"version": ">=1.5.4",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "narwhals",
|
|
"version": ">=2.17.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "typer",
|
|
"version": ">=0.24.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "narwhals",
|
|
"version": ">=2.17.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pyarrow",
|
|
"version": ">=23.0.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "fsspec",
|
|
"version": ">=2026.6.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "anthropic",
|
|
"version": ">=0.40.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "httpx",
|
|
"version": ">=0.28.1",
|
|
"extras": "socks"
|
|
},
|
|
{
|
|
"name": "pyyaml",
|
|
"version": ">=6.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pydo",
|
|
"version": ">=0.29.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "pdfminer",
|
|
"version": ".six>=20221105",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "resend",
|
|
"version": ">=2.0.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "opentelemetry-api",
|
|
"version": ">=1.45.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "opentelemetry-sdk",
|
|
"version": ">=1.45.1",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "opentelemetry-exporter-otlp-proto-grpc",
|
|
"version": ">=1.25.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "opentelemetry-exporter-prometheus",
|
|
"version": ">=0.46b0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "opentelemetry-instrumentation-fastapi",
|
|
"version": ">=0.46b0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "opentelemetry-semantic-conventions",
|
|
"version": ">=0.46b0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "psutil",
|
|
"version": ">=5.9.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "coverage",
|
|
"version": ">=7.13.4",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "databricks-sdk",
|
|
"version": ">=0.85.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "databricks-bundles",
|
|
"version": ">=0.295.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "boto3",
|
|
"version": ">=1.35.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "s3fs",
|
|
"version": ">=2026.2.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "google-cloud-storage",
|
|
"version": ">=2.18.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "gcsfs",
|
|
"version": ">=2024.1.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "azure-storage-blob",
|
|
"version": ">=12.23.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "adlfs",
|
|
"version": ">=2024.1.0",
|
|
"extras": ""
|
|
},
|
|
{
|
|
"name": "uv-build",
|
|
"version": ">=0.7,<1",
|
|
"extras": ""
|
|
}
|
|
],
|
|
"project_dev": [],
|
|
"notebook": [],
|
|
"dockerfile_adhoc": []
|
|
},
|
|
"npm": [
|
|
{
|
|
"name": "@docusaurus/core",
|
|
"version": "^3.10.2"
|
|
},
|
|
{
|
|
"name": "@docusaurus/preset-classic",
|
|
"version": "^3.10.2"
|
|
},
|
|
{
|
|
"name": "@easyops-cn/docusaurus-search-local",
|
|
"version": "^0.55.3"
|
|
},
|
|
{
|
|
"name": "@mdx-js/react",
|
|
"version": "^3.1.1"
|
|
},
|
|
{
|
|
"name": "clsx",
|
|
"version": "^2.1.1"
|
|
},
|
|
{
|
|
"name": "prism-react-renderer",
|
|
"version": "^2.4.1"
|
|
},
|
|
{
|
|
"name": "react",
|
|
"version": "^18.3.1"
|
|
},
|
|
{
|
|
"name": "react-dom",
|
|
"version": "^18.3.1"
|
|
},
|
|
{
|
|
"name": "@docusaurus/module-type-aliases",
|
|
"version": "^3.10.2"
|
|
},
|
|
{
|
|
"name": "@docusaurus/types",
|
|
"version": "^3.10.2"
|
|
},
|
|
{
|
|
"name": "typescript",
|
|
"version": "~5.6.3"
|
|
}
|
|
],
|
|
"ci_tools": [
|
|
{
|
|
"name": "uv",
|
|
"version": "latest"
|
|
},
|
|
{
|
|
"name": "trivy",
|
|
"version": "latest"
|
|
}
|
|
],
|
|
"base_images": {
|
|
"infra/gitea/Dockerfile": [
|
|
"docker.io/library/golang:1.25-alpine3.22",
|
|
"docker.io/library/alpine:3.22"
|
|
],
|
|
"infra/images/selkies/Dockerfile.upstream": [
|
|
"${DISTRIB_IMAGE}:${DISTRIB_RELEASE}"
|
|
]
|
|
}
|
|
}
|